Privacy Policy

1. Scope and Overview

1.1 Operator Identity

SiteHunter.io LLC, a Texas limited liability company (“SiteHunter,” “we,” “us,” or “our”) operates the website located at https://sitehunter.io and all associated subdomains, APIs, and services (collectively, the “Service”). Our principal place of business is in Austin, Texas.

1.2 Geographic Scope

The Service is directed exclusively to residents of the United States. By accessing or using the Service, you represent that you are located in the United States. We do not intentionally collect data from, or direct the Service toward, residents of the European Economic Area (EEA), the United Kingdom, or Canada.

1.3 Two Categories of Data Subjects

This Policy addresses two categories of data: (a) Platform User Data — information about visitors, people joining our waitlist, and registered users; and (b) Business Subject Data — information about third-party businesses surfaced in search results, including public contact information and assessments derived from it. Business records may include information identifying an owner, sole proprietor, or other business representative. These categories describe how we use the data; they do not determine whether a particular record is personal information under applicable law.

1.4 Effective Date and Updates

This Policy is effective as of September 10, 2026. We may update this Policy from time to time. If we make material changes, we will notify registered users by email at the address associated with their account at least thirty (30) days before the changes take effect. Continued use of the Service after the effective date of any updated Policy constitutes acceptance of the updated terms.

2. Account and Visitor Data

2.1 Information You Provide Directly

• Email address — required to create and maintain your account.
• Password — stored as a one-way cryptographic hash. We never store your password in plaintext and cannot retrieve it.
• Profile and onboarding information — information you submit, such as your display name, company, and selected home city, including the coordinates associated with that city.
• Search query inputs — the business type and city or geographic location you enter when initiating a market scan.
• Saved results and feedback — leads you save, preferences, ratings or reports you submit about results, and messages you send to support.
• Waitlist information — your email and any information you submit when requesting access.

2.2 Information Collected Automatically

• IP address and approximate location — IP address, inferred city, region, country, postal area, and network information collected with signup and usage metadata. IP addresses are also used for security and fraud prevention. This is not continuous GPS tracking.
• Device and browser signals — browser, operating system, screen size, timezone, and a device identifier collected with signup metadata.
• Usage and diagnostic information — pages visited, actions taken, results viewed, credit transactions, timestamps, errors, and performance information. Events can be associated with your session and, when signed in, your account.
• Referral and campaign information — referring pages and campaign parameters associated with a visit or signup.
• Browser storage and identifiers — cookies, local storage, and session storage used for preferences, authentication-related flows, cached results, and session or campaign identification. Some stored values are sent to us or our providers when you use the Service; see Section 9.

2.3 Payment and Transaction Data

Stripe collects payment card details through Checkout. SiteHunter.io does not store your full card number or security code. We exchange account and purchase information with Stripe, including your email address, account identifier, and purchase quantity. We retain purchase records such as transaction identifiers, amounts, payment status, Credits purchased, and your Credit balance. Stripe’s handling of payment information is described in its Privacy Policy.

2.4 Information We Do Not Collect

We do not collect Social Security numbers, government identification, or financial account numbers. We do not collect sensitive personal information as defined under California law beyond what is disclosed. We do not knowingly collect personal information from individuals under 18 years of age.

3. Business Information in Search Results

3.1 Categories of Business Data Collected

3.2 Nature of Business Data Collection

3.2.1 Publicly Accessible Sources. All business data is sourced exclusively from publicly accessible sources. These include public business listing services, publicly accessible websites, and publicly available email addresses associated with business domains. We do not purchase data from private data brokers, and we do not access any non-public or password-protected systems to obtain business data.

3.2.2 Business-Focused Collection. We collect information for business research, not to investigate private lives. A business listing or website may nevertheless identify a sole proprietor, owner, employee, or other representative. Personal information does not lose applicable privacy protections merely because we label it business data. See Section 10 for requests concerning information about you.

3.2.3 Automated Website Analysis. We fetch and render publicly accessible pages to examine technical signals, visible content, screenshots, and business contact or ownership evidence. AI providers may help analyze that material as described in Section 6. This research does not attempt to access restricted areas, submit forms, create accounts, or obtain private data from a business website.

3.3 Longitudinal Quality Score Retention

We maintain website assessment records to track business website conditions over time. Retention is not identical for every field: source-provider restrictions and field-level cleanup can require information to be refreshed or removed. Business information that identifies an individual is subject to applicable privacy rights, including the request process in Section 10. See Section 7 for retention information.

4. How We Use Platform User Data

4.1 Service Operation and Account Management

We use your Platform User Data to:

• Create, authenticate, and maintain your account.
• Process search queries and deliver search results.
• Track and manage your credit balance.
• Process payments through our third-party payment processor.
• Provide customer support and respond to inquiries.
• Maintain your search history and saved results.

4.2 Fraud Prevention and Abuse Enforcement

We use IP addresses, device metadata, and usage patterns to:

• Detect and prevent fraudulent account creation.
• Enforce our one-account-per-user policy.
• Identify and block automated abuse or scraping of the Service.
• Enforce rate limits to maintain Service availability.

4.3 Communications

We use your email address to send:

• Transactional emails — account verification, password reset, purchase confirmations, and credit balance notifications. These are necessary for account operation and cannot be opted out of.
• Marketing emails — product updates, new features, and promotional offers. You may opt out of marketing emails at any time by clicking the “unsubscribe” link in any marketing email or by contacting us at support@sitehunter.io.

4.4 Service Improvement

We use session- and account-associated usage events, diagnostic information, and aggregate reports to:

• Analyze how the Service is used to identify areas for improvement.
• Monitor system performance and reliability.
• Develop new features and capabilities.
• Conduct internal research and analytics.

When enabled, PostHog analytics can associate activity with account identifiers such as user ID, email, and display name. Sentry error monitoring can receive identifiers and diagnostic context when an error occurs. Analytics are not limited to anonymous or de-identified information.

4.5 Legal Compliance

We may use your data as necessary to comply with applicable laws, respond to valid legal processes, or protect our legal rights.

5. Who Receives Information

5.1 Third-Party Service Providers

We use providers for the functions below. Optional analytics and monitoring depend on the features and configuration in use; this list does not mean every provider receives every category of information.

Providers supporting accounts, service operation, and measurement:

Providers used for public-business research and analysis:

5.2 Other Disclosures

5.2.1 Legal Requirements. We may disclose your data if required by law, subpoena, court order, or other valid legal process, or if we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

5.2.2 Business Transfers. In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your data may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Service of any change in ownership or uses of your personal information.

5.2.3 No Sale of Personal Information. We do not sell, rent, or trade your personal information to third parties for their marketing purposes. For purposes of the California Consumer Privacy Act (CCPA/CPRA), we do not “sell” or “share” personal information as those terms are defined under California law.

5.2.4 No Third-Party Marketing. We do not disclose your personal information to third parties for their own direct marketing purposes.

6. Automated Decision-Making and AI Systems

6.1 Website Quality Scoring System

Automated website assessments use technical checks, visible design, and available business evidence such as public reviews. Separately, we collect online-presence and contact information to support users’ lead research.

Lead assessments concern businesses and their public web presence. They are informational outputs for a user’s own research, not a prediction that a business will purchase services or permission to contact someone in violation of applicable law.

6.2 AI-Assisted Website and Contact Analysis

When AI-assisted analysis runs, providers such as Anthropic may process:

• Text and screenshots from publicly accessible business pages.
• Business names, locations, and website context needed to interpret the evidence.
• Public ownership, role, and contact evidence to help identify business representatives.

These outputs can be incomplete or inaccurate. Our business-analysis requests are designed around public-business evidence, not Platform User passwords or payment card details. We will update this Privacy Policy before deploying an AI system that processes personal data in new ways.

6.3 Review and Security Decisions

We provide tools for reviewing automated outputs and reporting data-quality issues; not every result is manually reviewed. Separately, automated security checks use account, IP, and request signals, including anti-bot verification, to identify abuse and may restrict signup or access. If you believe a result or an access restriction is incorrect, contact support@sitehunter.io.

7. Data Retention

7.1 Platform User Data Retention

Account deletion requests are currently handled through support. Removing a saved lead from your list is not the same as deleting your account or the underlying business record. See Section 10 to make a privacy request.

7.2 Business Subject Data Retention

Business information is retained for research, result delivery, and assessment history. Different fields may be refreshed or removed at different times, including to meet source-provider restrictions. We do not treat all business information as permanently retained or categorically exempt from privacy requests. If a record identifies you, you can contact us using Section 10; applicable rights depend on the information and law involved.

7.3 Ephemeral Data

Certain data is processed transiently and not retained beyond the immediate processing session.

8. Data Security

8.1 Security Measures

We implement reasonable administrative, technical, and physical security measures to protect your data, including:

• Encryption of data in transit using TLS/SSL.
• Encryption of sensitive data at rest.
• One-way cryptographic hashing of passwords (passwords are never stored in plaintext).
• Access controls limiting employee access to personal data on a need-to-know basis.
• Regular security assessments and monitoring.
• Secure API authentication for all service-to-service communications.

8.2 Acknowledgment of Risk

No method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially reasonable means to protect your personal information, we cannot guarantee its absolute security.

8.3 Your Responsibilities

You are responsible for maintaining the confidentiality of your account credentials. You should use a strong, unique password and should not share your login information with any third party. Notify us immediately at support@sitehunter.io if you believe your account has been compromised.

9. Cookies and Tracking Technologies

9.1 Essential Session Data

We use session cookies or equivalent mechanisms to maintain authentication and support security and account flows. Blocking these mechanisms in your browser may prevent sign-in or other essential features from working.

9.2 User Preference Storage

Local and session storage can hold display preferences, selected locations, cached results, and session or attribution identifiers. Some values stay on your device; others are sent when you take an action such as signing up, purchasing Credits, or running a scan. You can clear browser storage through your browser settings, which may reset preferences or sign you out.

9.3 No Third-Party Advertising Trackers

We do not use third-party advertising cookies, tracking pixels, or similar technologies. We do not participate in advertising networks. We do not track your browsing activity across other websites. We do not build behavioral profiles for advertising purposes.

9.4 Product Analytics and Diagnostics

We use first-party event collection and, when enabled, PostHog, Sentry, and Vercel performance tools. These can process session identifiers, account identifiers, interactions, and technical diagnostics. PostHog can include session replay when enabled, which records interactions with the Service. Analytics may remain associated with an account and are not necessarily anonymous.

10. Your Privacy Rights

10.1 Rights Available to All U.S. Residents

Regardless of your state of residence, you may:

• Access the personal information we hold about you.
• Request deletion of your account and associated personal data.
• Opt out of marketing emails at any time.
• Update your account information through the Service interface.

10.2 California Residents — CCPA/CPRA Rights

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• Right to Know. You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collection, and the categories of third parties with whom we share it.
• Right to Delete. You may request that we delete the personal information we have collected about you, subject to certain legal exceptions.
• Right to Correct. You may request that we correct inaccurate personal information we maintain about you.
• Right to Opt Out of Sale/Sharing. We do not sell or share your personal information as defined under California law. No opt-out is necessary, but we will honor any such request.
• Right to Limit Use of Sensitive Personal Information. We do not collect sensitive personal information as defined under California law beyond what is necessary to provide the Service.
• Right to Non-Discrimination. We will not discriminate against you for exercising any of your CCPA/CPRA rights.

CCPA Categories Disclosure: In the preceding 12 months, we have collected the following categories of personal information as defined by the CCPA: Identifiers (email address, IP address); Commercial information (credit purchase records, transaction history); Internet or electronic network activity (usage logs, pages visited, features used); and Geolocation data (derived from IP address — city/state level only, not precise location).

10.3 Texas Residents — TDPSA Rights

If you are a Texas resident, you have the following rights under the Texas Data Privacy and Security Act:

• Right to Access. You may confirm whether we are processing your personal data and access that data.
• Right to Correct. You may correct inaccuracies in your personal data.
• Right to Delete. You may request deletion of your personal data.
• Right to Data Portability. You may obtain a copy of your personal data in a portable, readily usable format.
• Right to Opt Out. You may opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects. We do not engage in any of these activities.

10.4 How to Submit a Privacy Rights Request

To exercise any of your privacy rights, you may:

• Email us at legal@sitehunter.io with the subject line “Privacy Rights Request.”
• Include your account email address and specify the right(s) you wish to exercise.

We will verify your identity by confirming ownership of the email address associated with your account. We will respond to verified requests within 45 days. If we need additional time (up to an additional 45 days), we will notify you of the extension and the reason.

10.5 Authorized Agent

You may designate an authorized agent to submit privacy rights requests on your behalf. Authorized agents must provide written proof of authorization signed by you, along with verification of the agent’s own identity. We may contact you directly to confirm the authorization.

11. Children’s Privacy

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that we have inadvertently collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe that a child under 18 has provided us with personal information, please contact us at legal@sitehunter.io.

12. Links to Third-Party Services

The Service may contain links to websites or services operated by third parties. This Privacy Policy does not apply to those third-party services. We are not responsible for the privacy practices of third-party websites. We encourage you to review the privacy policies of any third-party services you access through links on our Service.

13. Contact Information

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

SiteHunter.io LLC
Austin, Texas 78751
Legal inquiries: legal@sitehunter.io
General support: support@sitehunter.io

14. Additional State-Specific Disclosures

14.1 Virginia — Virginia Consumer Data Protection Act (VCDPA)

Virginia residents have rights similar to those described in Sections 10.2 and 10.3, including the right to access, correct, delete, and obtain a copy of personal data, as well as the right to opt out of targeted advertising, sale of personal data, and profiling. We do not engage in targeted advertising, sale of personal data, or profiling as defined under the VCDPA. To exercise your rights, contact us at legal@sitehunter.io. If we decline your request, you may appeal by contacting us within 30 days, and we will respond to your appeal within 60 days.

14.2 Colorado — Colorado Privacy Act (CPA)

Colorado residents have the right to access, correct, delete, and obtain a portable copy of their personal data, as well as the right to opt out of targeted advertising, sale of personal data, and profiling. We do not engage in any of these activities. Colorado residents may exercise their rights by contacting us at legal@sitehunter.io. If we decline your request, you may appeal, and we will respond within 45 days. If the appeal is denied, you may contact the Colorado Attorney General.

14.3 Connecticut — Connecticut Data Privacy Act (CTDPA)

Connecticut residents have rights substantially similar to those provided under the Colorado Privacy Act, including the right to access, correct, delete, and obtain a portable copy of personal data, and the right to opt out of targeted advertising, sale of personal data, and profiling. We do not engage in any of these activities. Connecticut residents may exercise their rights by contacting us at legal@sitehunter.io. If we decline your request, you may appeal, and we will respond within 60 days.